CyberRota Analysis
AI-GeneratedBaserow 2.3.3 is vulnerable to a SQL injection flaw in the index() formula function, allowing low-privileged authenticated users to inject malicious SQL code through an undocumented fourth argument. This vulnerability can lead to unauthorized database access and manipulation, as the injected SQL executes with elevated privileges of the Baserow PostgreSQL role. Organizations using this version of Baserow should prioritize patching to mitigate potential data breaches and integrity issues.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user. This issue affects Baserow: 2.3.3.